No uploadWindows execution forensics

Every program run, read from Windows Prefetch

Drop .pf files, a whole Prefetch folder or a KAPE / Velociraptor collection. Run counts, the last eight launch times, volumes and loaded files — parsed locally in WebAssembly.

XP → Windows 11 (SCCA 17–31)
Triage ZIPs & folders
Runs offline in your browser

Drop .pf files, a Prefetch folder or a triage ZIP (KAPE, Velociraptor) here

Synthetic prefetch files from a fictional intrusion (host FIN-WKS-07) — no real data. Tip: click M64.EXE's last-run time to see what else ran within ±5 minutes.

100% client-side. Files are read in memory and never sent to a server.

No files yet? How to collect them ↓

Collection

How to get your data

Collect the Prefetch folder — one command below
Drop the folder or ZIP in the box above
Everything stays in your browser — nothing is uploaded

Windows, elevated prompt: right-click Command Prompt or PowerShell → Run as administrator. Nothing to install.

Copy every .pf file to C:\triage\Prefetch (the folder is created for you):
cmd / PowerShell
```
robocopy C:\Windows\Prefetch C:\triage\Prefetch *.pf /COPY:DAT /DCOPY:T
```
Prefetch files are not locked, so a plain elevated copy is complete — no shadow copy needed. Robocopy exit code 1 means "files copied". Then drop C:\triage\Prefetch on this page.
Optional — moving it to another machine? Zip it:
PowerShell
```
Compress-Archive -Path C:\triage\Prefetch -DestinationPath C:\triage\Prefetch.zip -Force
```
Drop Prefetch.zip as-is; it is opened in your browser.

Run as administrator on the host. KAPE and Velociraptor are free downloads from their publishers.

KAPE — target Prefetch:
cmd / PowerShell
```
kape.exe --tsource C: --tdest C:\triage\kape --target Prefetch
```
Drop the whole C:\triage\kape folder (it contains C\Windows\Prefetch\). Add --vss to also pull Prefetch from shadow copies. Already ran KapeTriage or !SANS_Triage? They include Prefetch — drop that collection folder or ZIP.
Velociraptor — offline collector with the Windows.Triage.Targets artifact (Velociraptor Triage project) and the Prefetch target (formerly Windows.KapeFiles.Targets on older releases):
Server Artifacts › Build offline collector › Windows.Triage.Targets › Targets: Prefetch › Launch
Run the collector as administrator on the host, then drop the resulting collection ZIP as-is. With a Velociraptor server, collect Windows.Triage.Targets → Prefetch from the client in the GUI and download the collection ZIP instead. Windows.Forensics.Prefetch parses on the endpoint and returns rows, not .pf files.

FTK Imager — open the image and export the folder:
File › Add Evidence Item › Image File › [root]\Windows\Prefetch › right-click › Export Files…
Choose C:\triage\ as the destination, then drop the exported Prefetch folder.
Image mounted read-only (Arsenal Image Mounter, ewfmount + ntfs-3g, …) — copy the folder:
cmd / PowerShell
```
robocopy E:\Windows\Prefetch C:\triage\Prefetch-image *.pf /COPY:DAT /DCOPY:T
```
bash
```
cp -a /mnt/win/Windows/Prefetch ./Prefetch
```
Replace E: or /mnt/win with where the Windows volume is mounted.
Older copies — shadow copies on a live host (Command Prompt as administrator):
cmd
```
vssadmin list shadows
```
cmd
```
mklink /d C:\vss1 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
robocopy C:\vss1\Windows\Prefetch C:\triage\Prefetch-vss1 *.pf /COPY:DAT /DCOPY:T
rmdir C:\vss1
```
Replace 1 in HarddiskVolumeShadowCopy1 (and vss1) with a number from the vssadmin list; repeat per snapshot. .pf files overwritten since the snapshot survive there. Drop the Prefetch-vss* folders together with the live one: identical files are skipped, older versions are grouped under the same executable.

Live system, Windows XP to 11 (%SystemRoot%\Prefetch):
path
```
C:\Windows\Prefetch\*.pf
```
In a disk image or triage collection, on the Windows volume:
path
```
\Windows\Prefetch\*.pf
```
Nothing else is needed — each .pf is self-contained. Layout.ini, Ag*.db and ReadyBoot\ sit in the same folder and are skipped with a reason, so just drop the whole folder or ZIP.
Windows 8+ keeps up to 1,024 .pf files (128 before) and 8 run times per file (1 before 8.1). Windows 10/11 files are MAM-compressed: drop them unmodified, they are decompressed in your browser.
Folder empty or missing? Check whether Prefetch is enabled:
cmd / PowerShell
```
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher
```
cmd
```
sc query SysMain
```
EnablePrefetcher: 0 = disabled, 3 = applications and boot (workstation default). Prefetch also stops when the SysMain service is not running, and is off by default on Windows Server.
Why Prefetch may be disabled →

Gotchas

Collect first. Every program you run on the live host — robocopy.exe and kape.exe included — writes its own .pf and can push older entries out of a full folder.
Short retention: at most 1,024 files and the last 8 runs per program. Older evidence lives in shadow copies (see Disk image & shadow copies).
Empty ≠ nothing ran: Prefetch is off by default on Windows Server, and when EnablePrefetcher = 0 or SysMain is stopped. All times shown here are UTC.

What you get

Built for the execution question

Did it run, when, how often and from where — answered from the .pf files, without installing anything.

Grouped by executable
All prefetch files of a program — different paths, hashes, shadow copies — collapse into one row with a combined run count.
All eight run times
Every launch slot Windows keeps (one before 8.1, eight since), in UTC, merged and de-duplicated across files.
Drop the whole collection
Folders and KAPE / Velociraptor ZIPs are searched for .pf files; anything skipped comes with the reason why.
Windows XP to 11
SCCA versions 17, 23, 26, 30 and 31. Windows 10/11 MAM-compressed files are decompressed in the browser.
Volumes and loaded files
Device path, serial number and creation time of each volume, plus every DLL and file the program touched — all searchable.
Private by design
A Rust parser compiled to WebAssembly runs in a Web Worker. No server, no upload; export everything as JSON.
Pick up where you left off
Each analysis is auto-saved in your browser (IndexedDB). Name it to keep it; resume, rename or delete saved sessions later.

How it works

How to parse a Prefetch folder

Drop a .pf file or the whole C:\Windows\Prefetch\ folder on this page. The parser runs entirely in your browser:

1
Files are read into memory locally — nothing is uploaded.
2
A Rust prefetch decoder compiled to WebAssembly decompresses and parses each file inside a Web Worker.
3
Results render as a sortable, searchable table. Click any row to see all run times, volumes, and referenced files.
4
Export everything as JSON for downstream tooling.

The artifact

What is Windows Prefetch?

Windows Prefetch (.pf) is a per-executable cache that Windows writes to C:\Windows\Prefetch\ every time a program is launched. Each file records what the program touched on its first run — the libraries it loaded, the volume it ran from, and how often it has been executed. For digital forensics, prefetch is one of the most reliable execution artifacts available: a program does not need to be installed or still present on disk to leave a .pf entry behind.

What each .pf file records

01Executable name and prefetch hash (derived from the launch path)
02SCCA version: 17 (XP/Vista/7), 23 (Win8), 26 (Win8.1), 30 (Win10), 31 (Win11)
03Run count — how many times the program has been executed
04Up to 8 last-run timestamps in UTC (Win8.1+)
05Volume info: device path, NTFS serial number, creation time
06Every DLL, configuration file, and resource the program loaded during prefetch capture

Artifacts that answer the next question in the same case.

FAQ

Frequently asked questions

Where does Windows store prefetch files?

C:\Windows\Prefetch\ — typically several hundred .pf files on any active workstation. The folder is restricted but readable by administrators. Prefetch is enabled by default on workstation editions of Windows; on Windows Server it is often disabled.

How is the 8-character prefetch hash calculated?

The hash at the end of each filename (NAME-XXXXXXXX.pf) is derived from the full executable path as a UTF-16 string. Two copies of the same binary launched from different directories produce two different .pf files. The algorithm changed between Windows XP/Vista and Windows 7+ (SuperFetch hash).

Why are Windows 8+ prefetch files compressed?

From Windows 8 onward, the OS compresses prefetch files with the Xpress Huffman algorithm and prefixes them with the MAM\u00104 signature. This parser decompresses them transparently — you don't need to pre-process anything before dropping the folder.

Are prefetch files reliable evidence of execution?

Yes — Windows only writes a .pf file after the executable actually runs. However, run counts and timestamps can be tampered with (e.g., by deleting prefetch files), and a missing entry does not prove a program never ran if .pf files were wiped post-execution. Combine with Amcache, ShimCache, and event-log data for corroboration.

Is anything uploaded to a server?

No. The parser compiles a pure-Rust prefetch decoder (frnsc-prefetch) to WebAssembly and runs it inside a Web Worker in your browser. Bytes never leave your machine. There is no backend, no telemetry on file contents, and no upload.

What versions of Windows are supported?

All SCCA versions from Windows XP through Windows 11: v17 (XP/Vista/7, uncompressed), v23 (Win8), v26 (Win8.1), v30 (Win10), and v31 (Win11). Both compressed and uncompressed prefetch files are detected automatically.

Point it at a Prefetch folder

Results in seconds. Nothing leaves this tab.

Parse prefetch files

How to get your data

Gotchas

Built for the execution question

Grouped by executable

All eight run times

Drop the whole collection

Windows XP to 11

Volumes and loaded files

Private by design

Pick up where you left off

How to parse a Prefetch folder

What is Windows Prefetch?

What each .pf file records

Related tools

Frequently asked questions

Point it at a Prefetch folder